Skip to content

Document how to prevent YAML-injection in Chart Templates? [2]#2165

Draft
meeque wants to merge 14 commits into
helm:mainfrom
meeque:issues/2154
Draft

Document how to prevent YAML-injection in Chart Templates? [2]#2165
meeque wants to merge 14 commits into
helm:mainfrom
meeque:issues/2154

Conversation

@meeque

@meeque meeque commented Jul 3, 2026

Copy link
Copy Markdown

This is an alternative PR for #2154.

I had the impression that previous PR #2158 didn't fit well with existing contents of the "YAML Techniques" appendix.

This PR attempts to address this by editing that appendix more heavily. Major changes are:

  • Split YAML types section into three:
    • Strings
    • Other Scalars
    • Collections
  • Move Collections section to the end of these, since collections often use scalars.
    (Not sure about this decision, can revert if original order is deemed preferable.)
  • For each section about YAML types, add a subsection about generating these types from dynamic values.
  • Add a security considerations section at the the bottom.

I know this is a big edit, sorry for the spam. But I feel it conveys what template authors need to know about generating YAML.

@meeque

meeque commented Jul 3, 2026

Copy link
Copy Markdown
Author

Note: I've tried to stick to the existing writing style of the appendix. I know that it contradicts the style-guide, but imho that should be addressed through a separate issue...

Michael Riedel and others added 14 commits July 3, 2026 22:42
Adjust document structure so that contents about secure YAML templating can be added more easily in the future.

Signed-off-by: Michael Riedel <meeque@meeque.de>
Move the existing section about indenting and templates after the new section, because it also generates strings from dynamic values.
Also add some TODO markers for other sections.

Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Also improve text and formatting in a few related sections.
And add more specific TODOs.

Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Paige Calvert <eura.calvert@gmail.com>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Paige Calvert <eura.calvert@gmail.com>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Signed-off-by: Paige Calvert <eura.calvert@gmail.com>
Signed-off-by: Michael Riedel <meeque@meeque.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants